Oihana PHP

EncryptionFormat uses ConstantsTrait

On-disk file format constants for {@see \oihana\files\openssl\OpenSSLFileEncryption}.

The V2 format is the authenticated, KDF-protected format produced by encrypt(). Files without the magic header are decrypted as legacy V1 (CBC + raw passphrase as key).

Layout of a V2 file:

┌─────────┬─────────┬─────────┬──────────┬──────────┬──────────────────────┐
│ MAGIC   │ VERSION │ KDF     │ SALT     │ IV       │ ciphertext + TAG     │
│ 4 bytes │ 1 byte  │ 1 byte  │ 16 bytes │ 12 bytes │ variable + 16 bytes  │
└─────────┴─────────┴─────────┴──────────┴──────────┴──────────────────────┘

The KDF byte indicates how the encryption key was derived from the passphrase. Storing it in the file lets a different environment decrypt the file — the receiver does not need the same KDF implementation available, only the one that was used at encryption time.

Tags
author

Marc Alcaraz (ekameleon)

since
1.0.0

Table of Contents

Constants

DEFAULT_CIPHER  : string = 'aes-256-gcm'
Default AEAD cipher used when writing V2 files.
GCM_IV_LENGTH  : int = 12
AES-GCM IV length in bytes (12 = 96 bits, NIST SP 800-38D recommendation).
GCM_TAG_LENGTH  : int = 16
AES-GCM authentication tag length in bytes (16 = 128 bits, maximum security).
HEADER_LENGTH  : int = 6
Total length of the V2 format prefix (MAGIC + VERSION + KDF) in bytes.
KDF_ARGON2ID  : int = 1
KDF identifier: Argon2id (memory-hard, GPU-resistant).
KDF_LENGTH  : int = 1
Length of the KDF-identifier byte (right after the version).
KDF_PBKDF2_SHA256  : int = 2
KDF identifier: PBKDF2-SHA256.
KEY_LENGTH  : int = 32
Derived symmetric key length in bytes (32 = 256 bits, fits AES-256).
LEGACY_CIPHER  : string = 'aes-256-cbc'
Default cipher used when reading legacy V1 files (no magic header).
MAGIC  : string = 'OPHE'
4-byte ASCII magic identifying an Oihana PHP Encryption file.
MAGIC_LENGTH  : int = 4
Length of {@see EncryptionFormat::MAGIC} in bytes.
PBKDF2_ITERATIONS  : int = 600000
PBKDF2 iteration count.
SALT_LENGTH  : int = 16
KDF salt length in bytes (16 = 128 bits, NIST recommendation).
VERSION_LENGTH  : int = 1
Length of the version byte.
VERSION_V2  : int = 2
Current on-disk format version, written right after the magic.

Constants

DEFAULT_CIPHER

Default AEAD cipher used when writing V2 files.

public string DEFAULT_CIPHER = 'aes-256-gcm'

AES-256-GCM is the modern standard: confidentiality + integrity in a single primitive.

GCM_IV_LENGTH

AES-GCM IV length in bytes (12 = 96 bits, NIST SP 800-38D recommendation).

public int GCM_IV_LENGTH = 12

GCM_TAG_LENGTH

AES-GCM authentication tag length in bytes (16 = 128 bits, maximum security).

public int GCM_TAG_LENGTH = 16

HEADER_LENGTH

Total length of the V2 format prefix (MAGIC + VERSION + KDF) in bytes.

public int HEADER_LENGTH = 6

KDF_ARGON2ID

KDF identifier: Argon2id (memory-hard, GPU-resistant).

public int KDF_ARGON2ID = 1

Requires ext-sodium at both encrypt and decrypt time.

KDF_LENGTH

Length of the KDF-identifier byte (right after the version).

public int KDF_LENGTH = 1

KDF_PBKDF2_SHA256

KDF identifier: PBKDF2-SHA256.

public int KDF_PBKDF2_SHA256 = 2

Always available (native PHP).

KEY_LENGTH

Derived symmetric key length in bytes (32 = 256 bits, fits AES-256).

public int KEY_LENGTH = 32

LEGACY_CIPHER

Default cipher used when reading legacy V1 files (no magic header).

public string LEGACY_CIPHER = 'aes-256-cbc'

Matches the historical OpenSSLFileEncryption constructor default.

MAGIC

4-byte ASCII magic identifying an Oihana PHP Encryption file.

public string MAGIC = 'OPHE'

MAGIC_LENGTH

Length of {@see EncryptionFormat::MAGIC} in bytes.

public int MAGIC_LENGTH = 4

PBKDF2_ITERATIONS

PBKDF2 iteration count.

public int PBKDF2_ITERATIONS = 600000

600 000 iterations of SHA-256 ≈ 250 ms on modern hardware. Matches OWASP 2023+ recommendation.

SALT_LENGTH

KDF salt length in bytes (16 = 128 bits, NIST recommendation).

public int SALT_LENGTH = 16

VERSION_LENGTH

Length of the version byte.

public int VERSION_LENGTH = 1

VERSION_V2

Current on-disk format version, written right after the magic.

public int VERSION_V2 = 2
On this page

Search results